Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [enumeration]

Pre-attack is a phase where an attacker attempts to discover information about their target. This can involve network reconnaissance, operational intelligence, historical information, etc.

Filter by
Sorted by
Tagged with
0 votes
2 answers
60 views

"Update my email", best way to prevent enumeration?

"Update my email" page has 2 fields: the new email and the current password. I cannot find the correct way to protect against user enumeration if there's an error on the email field: if I ...
Sumak's user avatar
  • 103
0 votes
1 answer
102 views

FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper

I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code. So far this is what I've ...
Michael Sodeke's user avatar
0 votes
0 answers
1k views

How to search for any file with a specified extension using Gobuster

A website allocates random file names to uploads and I am trying to enumerate through the folder that the files are uploaded to using Gobuster. I know the extension of my file type, but not the file ...
user2334659's user avatar
0 votes
0 answers
95 views

Enumerate Golang net/rpc Port?

I'm playing with a web app CTF for fun/learning. The backend is using Golang's net/rpc library to provide frontend access to what I think are database operations. The problem is I don't know what the ...
Enki's user avatar
  • 1
1 vote
0 answers
216 views

Is it possible to enumerate registered eepsite (I2P) subdomains?

Eepsites are similar to Tor's hidden services, but based on the I2P anonymity network. Named eepsites use central registrars like stats.i2p and no.i2p. Each eepsite also has a b32 domain which is a ...
forest's user avatar
  • 66.8k
0 votes
1 answer
113 views

Exploitation Risks and Considerations specific to running internal DNS servers

I have heard of larger companies are utilizing their own internal DNS servers to route through internal resources. And was wondering if there is any specific exploitation risks and considerations for ...
Rivesticles's user avatar
0 votes
0 answers
104 views

Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?

I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration. However, what about reading a ...
burninator's user avatar
1 vote
1 answer
262 views

DNS reverse lookup not finding domain name during enumeration

While enumerating a DNS server for a HTB machine, I've tried finding a domain name for 127.0.0.1: ┌──(kali㉿kali)-[~] └─$ dig -x 127.0.0.1 @10.10.11.166 ; <<>> DiG 9.18.1-1-Debian <<...
cppstudy's user avatar
  • 113
1 vote
0 answers
780 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
John's user avatar
  • 11
0 votes
1 answer
467 views

DNS Enumeration by IP Address

I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address? My ...
Mr John's user avatar
  • 11
3 votes
2 answers
379 views

Mail gateway allowing telnet connections

Our organization is currently being tested by a IT security firm who have stated that while our internet facing mail gateway is not an open relay, they can connect to it on port 25 using telnet and ...
Mailadmin's user avatar
0 votes
1 answer
666 views

Verifying IP addresses during pentest

When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
synthesis's user avatar
  • 155
0 votes
1 answer
199 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
Francesco Mantovani's user avatar
2 votes
1 answer
373 views

Rate Limit DNS Subdomain Requests

I work at a company that provides a SaaS program for other organizations, and each subscribed organization receives their own subdomain of their choosing - generally they choose the organization name. ...
Daryl1976's user avatar
  • 123
1 vote
1 answer
507 views

SNMP Enumeration

I'm scanning a machine that has the UDP port 161 open and I'm not able to run snmpwalk against it as I'm returned with the error: Timeout: No Response from <IP> I tried to run the onesixtyone ...
1afx0's user avatar
  • 11
1 vote
1 answer
191 views

Directories enumeration by errors. CVSS3.1 and remediation

Let's consider this scenario. If I browse to https://www.example.com/existentdirectory the web application shows this error "directory listing is denied". If I browse to https://www.example....
Maicake's user avatar
  • 567
1 vote
1 answer
2k views

AutoRecon is taking too long to complete

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing ...
Wolf's user avatar
  • 367
1 vote
1 answer
2k views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
ELA's user avatar
  • 13
0 votes
0 answers
140 views

Username enumeration with multiple inputs

Consider the case of username enumeration, where a hacker is able to determine a username based on UI feedback being different from a successful entry vs a failed entry. For example, a website's ...
AgentOrange90's user avatar
1 vote
1 answer
3k views

How to prevent Directory Enumeration Attacks (DirB or Directory Buster)

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
wolfhuntme's user avatar
1 vote
1 answer
1k views

It is possible to enumerate/discover IIS applications from outside?

I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address. If yes, how? And how can I protect my IIS from this ...
Roberto's user avatar
  • 21
2 votes
0 answers
139 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
Peter Turner's user avatar
2 votes
1 answer
112 views

Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )

I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
Adam D's user avatar
  • 131
0 votes
1 answer
209 views

Enumerating hosts running Elastic Stack

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
ficabj5's user avatar
  • 23
2 votes
1 answer
1k views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
Tobin Shields's user avatar
0 votes
1 answer
268 views

How to determine all public IP adresses from within an organization?

I can determine a single public IP address from within the organization (using NAT) by sending a HTTP request to one of the publically available services: curl ipinfo.io/ip However, if my request ...
Shuzheng's user avatar
  • 1,247
3 votes
1 answer
10k views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
john's user avatar
  • 149
10 votes
2 answers
1k views

How do exploit kits enumerate or fingerprint their targets?

My current understanding is that an exploit kit will fingerprint (gather information on) a system, check those details against a database of vulnerabilities and then attempt to use the relevant ...
Arlix's user avatar
  • 1,489
3 votes
1 answer
149 views

To what extent should we defend against leaked credentials being tested against our system?

We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try ...
AndySavage's user avatar
0 votes
1 answer
1k views

how to do internal subdomain enumerations in corp network?

I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
Jenny B's user avatar
  • 41
5 votes
2 answers
2k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
driver_'s user avatar
  • 51
3 votes
2 answers
781 views

What is the key to detecting all IoT devices in your organization? [closed]

In recent news, IoT devices are a target of hackers -- specifically botnet herders. The first step to securing your organization and its users is to detect all IoT devices that are functional on your ...
whoami's user avatar
  • 1,366
1 vote
2 answers
6k views

Discover Hidden WiFi SSID

How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?
user3496510's user avatar
  • 1,297
3 votes
2 answers
1k views

Fingerprinting servers behind firewall

I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80. I have used various switches for Nmap only -Pn ...
Airbourne's user avatar
  • 281
0 votes
0 answers
4k views

How to enumerate DCE services on open port 135?

I did a vulnerability scan on a machine and found a DCE Services Enumeration vulnerability. This is described as: Distributed Computing Environment (DCE) services running on the remote host can be ...
123's user avatar
  • 235
1 vote
2 answers
3k views

How can you enumerate an internal network with minimal outside knowledge?

The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet. Right out of the gate you know your IP, gateway, ...
Gray's user avatar
  • 758
3 votes
1 answer
204 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
Chris's user avatar
  • 682
6 votes
1 answer
2k views

Are these encrypted URL values safe or could they be guessed?

One of our suppliers had a weakness on the secure section of his webpage. By changing ID's in the URL, we could see data that did not belong to us. For example: https://supplier.org/showItem.do?...
Konerak's user avatar
  • 3,928
5 votes
1 answer
11k views

Beyond Nmap: Investigating open TCP ports bound to unknown services

I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me. However, I've ...
voices's user avatar
  • 1,779
8 votes
1 answer
529 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar device;...
voices's user avatar
  • 1,779
8 votes
6 answers
4k views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order ...
Anders's user avatar
  • 65.6k
7 votes
1 answer
6k views

Informative error messages in password reset functionality? [duplicate]

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
Abe Miessler's user avatar
  • 8,175
1 vote
3 answers
689 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
user94044's user avatar
0 votes
1 answer
107 views

Subdomain Bruteforcing when every request gets resolved?

Is it possible for an attacker to get a list of the subdomains configured for my server, if every subdomain request gets resolved? In the case of a subdomain that doesn't exist, the server simply ...
Tim's user avatar
  • 41
2 votes
1 answer
666 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
Juicy's user avatar
  • 1,447
1 vote
1 answer
446 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There is ...
Inquisitive's user avatar
9 votes
3 answers
18k views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
countermode's user avatar
1 vote
0 answers
448 views

How can a remote attacker find a user UID via Samba?

Is there a way to remotely retrieve the UID of a user via a Samba share? I can get the user list with: rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1 index: 0xa RID: ...
SilverlightFox's user avatar
2 votes
1 answer
198 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
musiKk's user avatar
  • 425
4 votes
3 answers
42k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
Max Rumpf's user avatar